WaratekVRT Sign in
Reset
More filters (2)
Columns
Published from 2025-07-01✕Product java✕
Overview 104 matches · 8 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
104matches 8protected7.7% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 8 7.7% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 96 92.3%
Critical 17 16.3% High 55 52.9% Medium 28 26.9% Low 4 3.8% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 7.7% partly blocked 0 0.0% not blocked 96 92.3% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 11 10.6% Forecast only 0 0.0% No public exploit 93 89.4%
split by peak 37 / month
No exploit published: 96Protected by Waratek: 8 Low: 4Medium: 28High: 55Critical: 17 not blocked: 96blocked by ARMR today: 8 No public exploit: 93Proof of concept only: 11
Sep 251 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Oct 250 Nov 253 Protected by Waratek1 No exploit published2 High3 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2 Dec 254 No exploit published4 High2 Medium2 not blocked4 No public exploit4 Jan 260 Feb 262 Protected by Waratek1 No exploit published1 Critical1 High1 blocked by ARMR today1 not blocked1 Proof of concept only1 No public exploit1 Mar 263 Protected by Waratek2 No exploit published1 Critical2 Medium1 blocked by ARMR today2 not blocked1 No public exploit3 Apr 261 No exploit published1 High1 not blocked1 No public exploit1 May 263 Protected by Waratek1 No exploit published2 Critical2 High1 blocked by ARMR today1 not blocked2 Proof of concept only1 No public exploit2 Jun 261 No exploit published1 High1 not blocked1 No public exploit1 Jul 2619 Protected by Waratek1 No exploit published18 Critical4 High14 Medium1 blocked by ARMR today1 not blocked18 Proof of concept only1 No public exploit18 Aug 2637 No exploit published37 Critical4 High22 Medium10 Low1 not blocked37 Proof of concept only1 No public exploit36 Sep 268 No exploit published8 Critical3 High3 Medium1 Low1 not blocked8 No public exploit8 Oct 2622 Protected by Waratek1 No exploit published21 High7 Medium13 Low2 blocked by ARMR today1 not blocked21 Proof of concept only6 No public exploit16
Oct 25Dec 25Feb 26Apr 26Jun 26Aug 26Oct 26
104 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 2 of 2 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2025-12183 High 2025-11-28 No exploit published No public exploit Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.
CVE-2025-66021 High 2025-11-26 No exploit published Proof of concept only OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available.
CVE-2025-64518 High 2025-11-10 Protected by Waratek No public exploit The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Starting in version 2.1.0 and prior to version 11.0.1, the XML `Validator` used by cyclonedx-core-java was not configured securely, making the library vulnerable to XML External Entity (XXE) injection. The fix for GHSA-683x-4444-jxh8 / CVE-2024-38374 was incomplete in that it only fixed parsing of XML BOMs, but not validation. The vulnerability has been fixed in cyclonedx-core-java version 11.0.1. As a workaround, applications can reject XML documents before handing them to cyclonedx-core-java for validation. This may be an option if incoming CycloneDX BOMs are known to be in JSON format.
CVE-2025-59340 Critical 2025-09-17 Protected by Waratek No public exploit jinjava is a Java-based template engine based on django template syntax, adapted to render jinja templates. Priori to 2.8.1, by using mapper.getTypeFactory().constructFromCanonical(), it is possible to instruct the underlying ObjectMapper to deserialize attacker-controlled input into arbitrary classes. This enables the creation of semi-arbitrary class instances without directly invoking restricted methods or class literals. As a result, an attacker can escape the sandbox and instantiate classes such as java.net.URL, opening up the ability to access local files and URLs(e.g., file:///etc/passwd). With further chaining, this primitive can potentially lead to remote code execution (RCE). This vulnerability is fixed in 2.8.1.
‹ prev page 2 of 2 next ›